Inside IT Switzerland
inside-it-ch · C · active
Swiss IT trade press; primary reporting on Swiss incidents (translate findings to English in brief). WebFetch returns HTTP 403 (re-confirmed 2026-05-08); the RSS feed at /feed.rss also 403's. REQUIRED FETCH METHOD: `python3 tools/fetch_source.py url https://www.inside-it.ch/`. | 2026-06-10: RSS bridge route https://www.inside-it.ch/rss.xml confirmed working via fetch_source.py url (resolves the prior 404 gap); no in-window security incidents on the feed this run. |. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → feed https://www.inside-it.ch/rss.xml 5 (via bridge; returns dated Swiss IT items, summary present) then bridge: python3 tools/fetch_source.py url <article-url> for body. Translate findings to English in the brief. AVOID: WebFetch 403s the homepage and the feed, skip WebFetch entirely. The old /feed.rss path 403'd historically; /rss.xml is the working feed. | 2026-07-05 (run 1208Z): rss_url field set to the working https://www.inside-it.ch/rss.xml path (S2 re-confirmed /feed 403s, /rss.xml 200 via bridge); metadata-drift correction only, no tier/status change. | 2026-07-05 admiralty audit: C, regional Swiss IT news aggregator, general/business-heavy, re-reports; kept for CH relevance. HIGH->C, stays active. | 2026-07-14 intel run: RECIPE CONFIRMED (S2): https://www.inside-it.ch/rss.xml reachable via DIRECT GET (200); article-detail pages still 403 to both WebFetch and jina. Use the feed for title/summary; article bodies remain unrecoverable. | 2026-07-14 (1210Z run): RSS https://www.inside-it.ch/rss.xml reachable via DIRECT GET (HTTP 200) on two runs today; the prior 403 rotation-gap history is stale; RSS usable for headline/discovery. Individual article-detail pages still 403 to both WebFetch and jina reader, so full bodies require a corroborating outlet (heise/swisscybersecurity.net). Keep active; fetch_method rss. | 2026-07-14: RSS again reachable (HTTP 200) and contributed the IFAGE/DragonForce item; article-detail pages still 403 to WebFetch and the jina reader. fetch_method stays rss. | 2026-07-28: HTTP 403 to every transport again this run. No demotion, transport/anti-bot block, not content death. | 2026-08-02: recovered. Rotation-priority after two failing runs (403); the RSS feed https://www.inside-it.ch/rss.xml returned 200 with 20 items via the bridge and the 403 did not recur. Failure counters reset; no in-window item, so counted as a quiet period. | 2026-08-05: RECIPE FIX, article pages still Cloudflare-403 to both the browser-UA fetch and the reader, but the RSS feed at https://www.inside-it.ch/rss.xml returns HTTP 200 with 20 dated items and usable summaries. Use the feed for DISCOVERY and recover article bodies from a corroborating publisher; it was the discovery surface for the VBS/RUAG item this run. Do not demote on the article-page 403. | 2026-08-12: article body 403s on direct WebFetch and on the bridge including its jina-reader fallback; RSS listing remains readable. Stories originating here may be recoverable via publisher-group siblings (swisscybersecurity.net / netzwoche.ch / it-markt.ch). 403 is transport blocking, not death, no demotion. | 2026-08-28 operator directive: promoted tier standard→essential; Heise Security and Inside-IT are operator-named critical sources and must be attempted every intel run (essential floor), not left to rotation; neither was attempted in the 2026-08-28 fire and heise last contributed 2026-06-20. | 2026-08-31 intel run: 3rd consecutive fire fully unreachable on every transport (S2/S3/S4 independently confirmed) - direct GET 403, trafilatura no readable body, jina reader relayed an upstream block/challenge, RSS path returned Cloudflare 526 (invalid origin SSL cert). Whole-host edge block, not a per-path issue. NOT demoted (transport block, hard rule); needs a new recipe or fetch_method: blocked if a 4th consecutive fire also fails. | 2026-09-01 intel run: S2 resolved this source cleanly on the first attempt (RSS feed HTTP 200, 20 dated items; article-detail extract worked beyond the free-preview paragraph before the subscriber paywall); the standing 3-consecutive-failure note from 2026-08-31 did not recur a 4th time. Failure counters reset; contributed the HWZ Payload data-publication update this run. | 2026-09-03 audit: whole-host HTTP 429 (rate-limited) on every transport this run (direct bridge, extract/jina, plain WebFetch), a new failure mode distinct from the prior paywall/403 conditions. 403/429 never demotes; not a recipe failure, monitor for recurrence. | 2026-09-04: RSS feed reachable (20 items) but article-body fetch still 429s ('Security Checkpoint', 3rd consecutive run); Insel Gruppe/ServiceNow backlog item remains unconfirmed. Not demoted, 403/429-class block, never a content-axis demotion trigger. | 2026-09-10 (S2): RSS feed and general article access continue to work cleanly (20 items, two new in-window articles read in full); the specific coverage_backlog.md article (insel-gruppe-verschiebt-wechsel-zu-servicenow-20260828) remains whole-host-unblocked but individually unreadable via every transport for an 11th+ consecutive fire. This is a persistent single-article dead end, not a source-level failure, no status/fetch_method change applied. | 2026-09-22: two sub-agents (S2) independently hit a new failure mode on this run, every individual article-detail page (not the RSS listing, which stayed healthy) returned HTTP 429 'Vercel Security Checkpoint' on both the extract/jina transport and plain WebFetch. Both leads found this run were still composed via corroborating outlets (covered_anyway: true). Distinct from the previously-documented Cloudflare/subscriber-paywall conditions on this host; worth a recipe review if it recurs. | 2026-09-30 intel run: article pages now return a Vercel Security Checkpoint (HTTP 429) to direct, bridge and WebFetch transports and the reader pool is exhausted; only the RSS teasers are readable. Needs a working reader credential or a sitemap route. | 2026-10-02 (2026-10-02T0404Z-intel): article pages still return a Vercel Security Checkpoint (HTTP 429) to extract, direct and jina; RSS teasers read. A later bridge `url <article>` probe on 2026-10-02 was served through the reader fallback, so the route is intermittent and spends reader credit. | 2026-10-05 S2: the RSS (`feed https://www.inside-it.ch/rss.xml 25`) reads directly (20 items, teaser text); article pages still return the Vercel 429 checkpoint to extract and the reader. | 2026-10-06 (S2, S4): no 429 on article pages this fire; `url <article URL>` returns the page whose __NEXT_DATA__ JSON carries the article body and `extract` also returned the Keystone-SDA body for two articles; the RSS (`feed https://www.inside-it.ch/rss.xml 25`) works as before. | 2026-10-07 (S2): `feed` plus `extract` read article pages with no 429 again; the Liechtenstein Landtag answer reached the pipeline through it. | 2026-10-15 (S2, S4): article pages return the Vercel Security Checkpoint HTTP 429 on every transport again; the RSS (`feed https://www.inside-it.ch/rss.xml 12`) reads, teasers only. The lead was covered from the funds' own notices. | 2026-10-16 S2: an article page read cleanly with `extract` (no Vercel 429); the block is intermittent, so try `extract` first and fall back to the RSS teaser. | 2026-10-17 (2026-10-17T0256Z-intel): S2: paywalled articles return only the lead through extract, but the full text sits in the raw HTML (rawState blocks); read them with `url <article URL>` and parse the JSON. | 2026-10-20 (2026-10-20T0256Z-intel) S4: https://www.inside-it.ch/feed returns 404; https://www.inside-it.ch/rss.xml is the working feed (matches the record). | 2026-10-25 (2026-10-25T1308Z-audit): G2 re-sweep: the RSS holds about three days; for lookbacks beyond that, `url --direct https://www.inside-it.ch/sitemaps/sitemap-72.xml` lists article URLs ending in -YYYYMMDD. | 2026-10-28 (S2): extract may return the raw page; the full article body is in the __NEXT_DATA__ JSON at props.pageProps.post.post.managed.published.elements[0].data.rawState.blocks[*].text.
Cited in 13 entries
Citation cadence
Citation days per ISO week (19 weeks of coverage span, total 13).
- Canton Vaud: unauthorised access to the IT-support platform of its Gymnases and professional schools copied the names, school e-mail addresses and support requests of about 3,500 teachers and 38,000 pupils; police arrested a 16-year-old pupil of the schools on 2026-10-312026-11-01
- ARA-Region Lyss-Limpachtal (canton Bern, communal wastewater-treatment association): SafePay has put about 49 GB into the darknet, which Risikomonitor's analysis, relayed by Inside IT, finds holds personal records, bank statements, weak passwords and a third party's monitoring credentials; the association declines to comment2026-10-28
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the City of Zurich fund PKZH saying its insured persons' test data was stolen, the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating2026-10-09
- Ixa Systems, a Vaud security integrator serving police, prisons and banks: camera locations, plans and some passwords that TheGentlemen claimed to have stolen are reported on sale on the darknet2026-10-08
- Swiss commune Manno (TI) confirms a cyberattack that encrypted part of its servers on 4 August 2026; SafePay has now published about 30 GB, which Risikomonitor reads as social-assistance decisions with AHV numbers, naturalisation files and a near-complete address book2026-09-30
- Swiss federal offices planned to outsource part of the E-ID trust infrastructure to Amazon Web Services; a ministerial veto stopped it in February 2026 on CLOUD Act and digital-sovereignty grounds2026-09-02
- A Zurich business school tells students their bank details and sick-leave records were stolen, not from its own systems, but through the infrastructure of an IT service provider whose leak-site listing names seven other Swiss customers alongside it, and does not close the list2026-08-23
- Liechtenstein's beneficial-ownership register breached: copies of ~31,000 legal entities' records taken, and four more e-government systems pulled offline as a precaution2026-08-04
- Everest ransomware breaches a Stadler Rail supplier data-exchange platform, demands CHF 10 million, the Swiss rail manufacturer refuses to pay2026-07-22
- DragonForce lists Geneva's IFAGE adult-education foundation on its leak site, claiming 850 GB; an attribution and volume IFAGE has not confirmed2026-07-14
- Psychiatrische Dienste Aargau (PDAG) email accounts compromised via phishing and abused to relay spam2026-07-09
- "The Gentlemen" ransomware claims 478 victims and adds worm propagation, Switzerland the second-most-targeted European country2026-06-27